1. Stream Format

Encrypted WebM streams are encrypted at the block level with AES-128 CTR encryption. The container shall include appropriate values within the ContentEncryption element.

WebM streams may be partially encrypted, both at the Track level and the block level. In the former case, a subset of Tracks in the stream have a ContentEncryption element. In the latter case, a subset of the blocks within a Track containing a ContentEncryption element are marked as encrypted.

2. Detecting Encryption

When a WebM Track is parsed, the presence of a ContentEncKeyID element shall indicate that the stream is potentially encrypted. Each time a new value is encountered in a ContentEncKeyID element, the Initialization Data Encountered algorithm shall be invoked with the value in that element as initData.

Encrypted blocks are those marked encrypted by the Signal Byte.

3. Initialization Data and Events

Initialization Data in events is always a key ID, which is the ContentEncKeyID of the current Track. The current Track is the one being parsed or that contains the block being decrypted.

Events only contain a single key ID. However, if supported by the key system, multiple key IDs may be bundled by the application before requesting a key and multiple key ID-key pairs may be returned by the license server.

An event will be fired for each new key ID (in ContentEncKeyID) encountered.